Catégorie : GDPR

The processing of personal data is an operation that has become increasingly important over the years, especially with the evolution of technology. Essential for many companies for technical and economic reasons, the collection, modification or use of such personal data can, however, undermine the fundamental rights and freedoms of individuals if they are not properly framed. The GDPR intervenes at this level.

The GDPR: What is it about?

It is no longer necessary to establish a PDSR definition as the development of this initial is quite explicit: General Regulation on Data Protection. This is a mandatory text, published by the European Union on 25 May 2018, establishing the responsibility of companies for their personal data processing work. The aim of this regulation is to better secure citizens and to better guarantee their right to privacy. Non-compliance of a company’s actions with the GDPR exposes it to heavy financial penalties. The CNIL or National Commission for Information Technology and Civil Liberties monitors this compliance.

How do you know if your company is in compliance with the GDPR?

Certain points must be observed for a company to be in compliance with the GDPR. The first concerns the way in which data is collected. This collection must be fair, lawful and proportionate. All individuals concerned must be explicitly informed about the processing of their personal data and the purposes of the processing must be determined, lawful, relevant and limited to what is strictly necessary. Furthermore, certain individual rights enshrined in the text must be respected, in particular the right of access to the information collected and transparency, the right to be forgotten, the right to informed consent, etc. Last but not least, each company must keep documentation of compliance, tracing all the measures it has undertaken in the context of its data processing activities.

What are the obligations on business managers?

With the entry into force of this regulation, employers have data protection obligations not only towards consumers, but also towards their employees and partners. To this end, they have an obligation to carry out an impact study: they must consult their employees before any data processing within the company and must ensure that all the tools used in their companies respect the privacy of the latter.

The General Data Protection Regulation is a device that protects the personal data of individuals. Companies in the field of data processing, whether they are data controllers or subcontractors, are required to comply with this regulation. Find out in our article about the data controller’s obligation of transparency.

The available means of information

Data subjects are the persons whose data is collected and processed. The obligation of transparency implies that the data subjects have the right to request information from the data controller. The latter must comply with several conditions imposed by the Regulation. In principle, the information must be concise, comprehensible, accessible, clear and simple. The provision of information is made at the request of the data subject. The request may be made by electronic means. In this case, the information shall be provided by electronic means. However, it may be provided in writing. Oral communication is also possible.

Time limits to be respected by the controller

The controller must provide the information within one month. It runs from the date of receipt of the request. This period may be extended due to multiple requests. It is limited to a period of two months, but the controller must inform the data subject of the reasons for the extension. The controller has the right not to comply with the data subject’s request. It must notify the data subject of the reasons for its inaction within one month. Thus, this refusal entitles the applicant to appeal to the court or the administrative supervisory authority.

Questions relating to the costs of providing information

The information provided is free of charge except in specific cases provided for in the Regulations. This applies to unfounded, excessive or repetitive requests from data subjects. In such situations, the controller may request payment of a reasonable sum or refuse to provide the information. The information to be provided is already provided for in the Regulation. The right to information GDPR differentiates between the information to be provided if the data are collected from the data subjects or other persons. The law also sets out further information to be provided if the controller intends to further process the data.

Faced with the increasing number of computer security breaches, it is more than necessary to protect personal data. In order for this protection to be effective, a law on the subject has even been introduced: the GDPR. What is it all about? And how to collect the GDPR consent?

The GDPR, in a few words!

The GDPR, or General Regulation on Data Protection, is a law that governs the processing of personal data within the European Union. This data concerns all information relating to the identity of a natural or legal person (the company). In principle, this information is personal and is not accessible to others. Nevertheless, in certain cases, the processing of this data is imperative.

The main principles

The GDPR applies not only to the owners of the data but above all to the controller. According to its Article 6, the collection and processing of data must be lawful and transparent. In other words, they must be notified of the data subject and the data collected must comply with what has been mentioned. Likewise, the data subject has the right to access, modify or delete his or her personal data. He or she can also refuse the processing: this is the principle of GDPR consent. Finally, consent must be proved, through a positive statement or act. (For example, a ticked box if the processing is done online).

Consent of the GDPR

According to the GDPR, data processing cannot be carried out without the consent of its owner. But what is meant by consent? By definition, consent is a manifestation of will. It must be free, informed, and prior. Situations such as violence or fraud, therefore, constitute a defect of consent.

The GDPR has even added a right of withdrawal. This means that the person concerned may at any time withdraw his or her consent, through a simple modality. Similarly, the controller must demonstrate the existence of consent, otherwise, the processing cannot be carried out. The processing of personal data of minors is also prohibited unless the minor is at least 16 years old and has received parental authorization and consent. However, GDPR consent has certain limits. It is not required when the processing has a legitimate interest for the controller. This is the case for the performance of a contract. In this case, the applicable terms and conditions depend on the clauses concluded between the two parties.

The General Data Protection Regulation (GDPR) is a common framework for the member countries of the European Union concerning the processing and circulation of personal data. It applies to all public and private entities likely to handle information belonging to European citizens such as companies, processors, and associations.

A stronger defense for the Internet user

The main objective of the GDPR, which entered into force on 25 May 2018, is to reinforce the importance of protecting the privacy of Internet users at the heart of businesses, and since its application, improvements have been noted. In fact, at present, GDPR internet users benefit from enhanced protection and better management of their personal data (name, photograph, IP address, the computer connection identifier, etc.). Sensitive data or data relating to information that may cause discrimination or prejudice are also protected by this framework, such as political opinion, religious sensitivity, ethnicity, sexual orientation, etc.

Requesting consent before handling data

The GDPR obliges companies that wish to use the personal data of an Internet user to obtain his or her consent prior to any processing in a clear, explicit, and comprehensible manner so that the person concerned knows how his or her data will be used. Moreover, any processing must be done in compliance with the GDPR, otherwise, it may be subject to heavy sanctions. The GDPR Internet user is at the origin of numerous reminder emails imploring the user’s consent so that the service to which the user has subscribed can continue to send him or her mail.

 New rights for internet users

The GDPR sets up recognition for the Internet user of certain rights relating to the protection of their intimate life. These include the « right to data portability » allowing the GDPR Internet user to retrieve all his information and to transfer it from one site to another. It also introduces the « right to oblivion » or the right to make all information disappear in the event of a breach of privacy, as well as the right to be informed in the event of hacking or security breaches related to their data. The content of the GDPR also allows the victim, in case of damage, to take legal action against an offending company, under the « right to compensation for the damage suffered ».

Applied since May 2018, the GDPR or « General Regulation on Data Protection » is a regulation that governs the processing and circulation of personal data throughout Europe. Indeed, the company can benefit from many advantages of this great change.

Reinforces security

In recent years, the problems caused by computer data piracy have taken a heavy toll. Because cybersecurity is at the heart of the matter, the new regulation is based on improving the privacy and security of the personal data of any internet user living in Europe.  Thus, this is an opportunity for any company to implement all good security practices in order to reassure their customers and future customers.  Managers can carry out a whole overhaul to achieve these new technical and organizational measures, such as appointing a leader, reducing the number of people with direct access, placing passwords…

Offers more professionalism

With this constant rise in hackers, Internet users are becoming increasingly suspicious and may even go so far as to falsify their own personal data. With a GDPR company, customers are more confident and the company is seen as more professional in the way it does business. It should not be forgotten that consumer opinions are important parameters on the internet. Thus, the installation of this new regulation would allow the company to offer more professionalism to its customers by ensuring better treatment and more confidentiality so that they can deliver real information. In the same way, if the company works with subcontractors (suppliers…), it will have to require that these subcontractors also comply with the GDPR standards.

Optimize marketing strategies

The GDPR, in its use, modifies certain settings such as e-mailing for example. Indeed, to be able to receive your e-mail, your correspondent must first accept it. Thus, by consenting, professional links are woven through the web. This allows for better productivity because the contact list is made up of relatively interested people. Computer security is a major asset for marketing, so it is in the company’s best interest to respect and practice to the letter the rules of data security and confidentiality. It should be noted that any person has the right to modify, communicate or delete all information concerning him/her if he/she so chooses.

Recruiting in-house IT experts can be time-consuming, tedious, and expensive. Not to mention that they will be a fixed expense for the company. To reduce costs, it is best to entrust the management and maintenance of your IS (computer system) to a specialized company. How to find the right service provider? What are the selection criteria?

IT outsourcing: what exactly is IT outsourcing?

Outsourcing consists of outsourcing all or part of the management, optimization, and security of a company’s IT system to a competent service provider. It can therefore be global or partial outsourcing. Thanks to new technologies, the service can be carried out remotely, which makes it possible to considerably reduce human contact as well as costs. At present, three types of outsourcing can be distinguished. Structural outsourcing aims to operate, develop and maintain the equipment. Application outsourcing, on the other hand, takes charge of everything concerning applications. Finally, there is business outsourcing, which mainly targets the business process.

An outsourcing contract includes several services. While maintenance and repairs of computer breakdowns are the most common services, the service provider can also take charge of IS management. But faced with needs that are increasingly different, experts always try to offer tailor-made solutions according to customer expectations: IT audit, installation of software and updates, IS operation, maintenance for curative purposes, cloud computing, etc.

What are the advantages of IT outsourcing?

Regardless of the size of your company, you can use outsourcing to optimize internal resources and benefit from a better quality of service. An expert company in this field has the necessary technical skills and a better knowledge of technologies to ensure the proper functioning of an IT infrastructure while optimizing its performance. Outsourcing also allows you to make significant savings in terms of resources and infrastructure.

In addition, this solution allows you to quickly detect breakdowns and possible faults in your IT equipment. Solutions can therefore be found in time to limit the damage that can have an impact on turnover and damage the brand image. Outsourcing also means ensuring compliance with good IT practices.

Moreover, the services are tailor-made. It is indeed possible to delegate only certain points in order to minimize expenses. Finally, these professionals play the role of advisor. They are in the best position to guide you in the choice of your hardware and the applications to be installed, but also to provide you with neutral and informed advice.

How to choose an outsourcing company?

Certainly, outsourcing the IT service allows you to reduce costs and access more efficient infrastructures in order to optimize production. But not all service providers are the same. That’s why it’s a good idea to find out about the professional who has caught your attention before signing a contract. On the opinion forums, you can access the opinions and testimonials left by other SMEs that have already used its services. Experience in this field is also a guarantee of efficiency. Therefore, collaborate with a contact person who has been working in this sector for several years.

Location can also make a difference. Ideally, you should rely on proximity in order to save time when traveling and money on costs. If the agency is close to your premises, the expert will be able to intervene quickly in the event of a problem. However, this detail is not important if the company plans to manage your computer equipment remotely.

Moreover, the solutions proposed must be adapted to the real needs of your company and your employees. This is why the outsourcing expert must be able to consider all the elements in order to be able to provide you with a personalized service that is worthy of your means.